Shift-Left Security: Integrating Security in the Initial Phase of the DevOps Methodology

Traditional software development practices often defer security implementation to later stages of the development cycle, leading to delayed vulnerability detection, increased remediation costs, and increased security risks. The emerging “Shift-Left” paradigm addresses these challenges by integrating security considerations early in the development process. This paper proposes a five-step approach to integrating security earlier in the DevOps development methodology. It utilises the STRIDE model during the planning phase of DevOps to elicit, specify, and validate security requirements early in the development process. To this effect, the research uses the CAIRIS platform to facilitate comprehensive requirements, security and usability engineering activities during the plan phase of the DevOps methodology. Our approach is validated through a detailed organisational case study of a globally deployed distributed management system that orchestrates stakeholder network operations. Through a comprehensive two-tier approach that combines qualitative interviews and experimental implementation, we systematically identified and analysed the threats and vulnerabilities of the system. Our intervention revealed distinct security threats across all five categories of the STRIDE methodology, each of which were mapped to corresponding mitigation strategies. These findings validate the practical benefits of our methodology in strengthening system security during the initial development phases.